Windows Update and users type

Hi

I have Windows 11 23H2 Enterprise

How do I disable Windows Update updates for all accounts except those in the Administrators group?

Thanks

Bye

Change the Group Policy:

garlin said:

Change the Group Policy:

Enable or Disable Check for Windows Updates in Windows 10

How to Enable or Disable Check for Windows Updates in Windows 10

www.tenforums.com

Click to expand...

Maybe you didn't understand:

My purpose would be to enable the use of the Windows Update service only for the users belonging to the Administrators group so that Windows 11 can download the updates only when one of these users is logged in.

Now, do you understand?

Thanks

Bye

That is the same policy for blocking non-Admin users from triggering an update. It's right in the tutorial:

You must be signed in as an administrator to be able to enable or disable check for updates.

Click to expand...

If you're expecting to block WU from running when no user is logged in (Admin or non-Admin) then you should disable automatic updates at the same time.

garlin said:

That is the same policy for blocking non-Admin users from triggering an update. It's right in the tutorial:

Click to expand...

That line is about who can make the policy change, not who can run updates.

SetDisableUXWUAccess​

Scope	Editions	Applicable OS
Device User	Pro Enterprise Education Windows SE IoT Enterprise / IoT Enterprise LTSC	Windows 10, version 1809 [10.0.17763] and later

Device
./Device/Vendor/MSFT/Policy/Config/Update/SetDisableUXWUAccess

This setting allows you to remove access to scan Windows Update.

If you enable this setting user access to Windows Update scan, download and install is removed.

Description framework properties:

Property name	Property value
Format	int
Access Type	Add, Delete, Get, Replace
Default Value	0

Allowed values:

Value	Description
0 (Default)	Disabled.
1	Enabled.

Group policy mapping:

Name	Value
Name	DisableUXWUAccess
Friendly Name	Remove access to use all Windows Update features
Location	Computer Configuration
Path	Windows Components > Windows Update > Manage end user experience
Registry Key Name	Software\Policies\Microsoft\Windows\WindowsUpdate
Registry Value Name	SetDisableUXWUAccess
ADMX File Name	WindowsUpdate.admx

Click to expand...

garlin said:

Update Policy CSP - Windows Client Management

Learn more about the Update Area in Policy CSP.

learn.microsoft.com

Click to expand...

Doesn't just block non-admin users from using check for updates.

I finally worked out a different answer by using System Settings page visibility to hide WU's features, and enforced by a local policy on the Non-Administrators users group.

1. Visit the Security Compliance Toolkit page, and click Download. Only select the LGPO.zip file.
2. Extract the LGPO.exe file.
3. Extract the included ZIP file in the same folder as LGPO.exe

Never install a random Policy file from someone you don't trust.

To verify Registry.pol's contents, run this command:
LGPO.exe /parse /un Registry.pol


4. LGPO.exe /un Registry.pol

Have you tested it?

Another detail:

If I wanted that only users belonging to the Administrators group could download the updates from Windows Update and update the system, how could I do that?

Thanks

Bye